From 5d4971a3037d4749c9108ef4482248a2f81b50cf Mon Sep 17 00:00:00 2001
From: Joris Wouter Jonkers <74975850+ExtraToast@users.noreply.github.com>
Date: Wed, 21 Oct 2026 13:25:26 +0200
Subject: [PATCH 1/2] chore: Renovate alone updates dependencies, so
 Dependabot's fallback goes

---
 .github/dependabot.yml | 34 ----------------------------------
 1 file changed, 34 deletions(-)
 delete mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index cbecd68..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-# Renovate (renovate.json) is the primary dependency manager for JorisJonkers-dev
-# repos. Dependabot is enabled only for GitHub Actions as a belt-and-braces
-# fallback; disable this file if Renovate covers actions in a given repo.
-#
-# Keep the same dependency policy shape as the richer templates under
-# templates/dependency-policy/: 7-day cooldown for third-party releases (our own
-# org is excluded), grouped minor/patch updates,
-# separate security grouping, and isolated majors.
-version: 2
-updates:
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: weekly
-    cooldown:
-      default-days: 7
-      # Our own releases are already gated by their publishing repo's
-      # pipeline, so a cooldown only delays first-party propagation.
-      exclude:
-        - "JorisJonkers-dev/*"
-    open-pull-requests-limit: 5
-    groups:
-      actions:
-        applies-to: version-updates
-        update-types:
-          - minor
-          - patch
-        patterns:
-          - "*"
-      actions-security:
-        applies-to: security-updates
-        patterns:
-          - "*"
-    labels: ["dependencies", "github_actions"]

From 1bf3e21c3f0f34a09dba8b0bd809b0a9d3e6acdf Mon Sep 17 00:00:00 2001
From: Joris Wouter Jonkers <info@jorisjonkers.dev>
Date: Wed, 21 Oct 2026 17:35:04 +0200
Subject: [PATCH 2/2] ci: run on ubuntu-22.04, whose kernel mongo:8.0 starts on

GitHub's current runner kernels fall in the 6.19 to 7.0.13 range that mongo:8.0 refuses (SERVER-121912), and overleaf needs Mongo 8. The smoke step prints the runner kernel so a future change shows up in the log.
---
 .github/workflows/ci.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d96542e..28ccfaa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,8 @@ permissions:
 jobs:
   pipeline-complete:
     name: Pipeline Complete
-    runs-on: ubuntu-latest
+    # mongo:8.0 refuses kernels 6.19 to 7.0.13 (SERVER-121912); 22.04 runs an older one.
+    runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -46,4 +47,6 @@ jobs:
       # dropped, and only /var/lib/overleaf, /run and /tmp writable.
       - name: Start and compile under the restricted posture
         if: ${{ !cancelled() }}
-        run: scripts/smoke-test.sh overleaf:ci overleaf-redis:ci
+        run: |
+          echo "runner kernel: $(uname -r)"
+          scripts/smoke-test.sh overleaf:ci overleaf-redis:ci